Is Firefox lying to users about viruses in downloads? • Hacker News Board

Re: Is Firefox lying to users about viruses in downloads?

#51

Post by davidsong » Wed, Jul 04, 2018, 4:24 PM UTC

sandov wrote: post #45

davidsong wrote: post #30

There are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them. The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 1…

Or don't use a vulnerable PDF viewer, or OS.

Or put it anywhere a vulnerable PDF viewer or OS might stumble upon, where an overzealous scanner has write access to, or where some snitch might grab a copy from and blacklist your domains.

Re: Is Firefox lying to users about viruses in downloads?

#52

Post by konceptz » Wed, Jul 04, 2018, 4:26 PM UTC

sandov wrote: post #42

yodon wrote: post #21

If only the voting public understood about statistics, false positives, and false negatives. Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results. The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the…

And why the hell should the browser act as an antivirus?. It's a browser, not an antivirus, it should assume the user knows what he's doing, not treat him like a toddler. It's just a huge annoyance with no considerable benefit.

In the web security space its typically called the browser security model and there are differences between browsers. The browser is not just a portal forwarding/displaying the intentions of the developers. If you want to see one of the more obvious examples look at the same origin policy and how it’s implemented across browsers.

Having said that, I do agree that browsers shouldn’t implement lots of crazy features but I personally don’t mind if they have some kind of malicious file scanning feature.

Re: Is Firefox lying to users about viruses in downloads?

#53

Post by heathl » Wed, Jul 04, 2018, 4:29 PM UTC

mediocrejoker wrote: post #34

davidsong wrote: post #30

There are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them. The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 1…

I could be wrong but I think technically a PDF exploit only affects a single viewer program, like Acrobat on windows, right?

It would depend on the exploit. For a simple example, an exploit that was a result of a flaw in the file specification could result in it being cross platform.

It's going to be rarer to find something of that scope, maybe even to the point of you being effectively right.

Re: Is Firefox lying to users about viruses in downloads?

#54

Post by davidsong » Wed, Jul 04, 2018, 4:37 PM UTC

heathl wrote: post #53

mediocrejoker wrote: post #34

Earlier quoted context omitted.

I could be wrong but I think technically a PDF exploit only affects a single viewer program, like Acrobat on windows, right?

It would depend on the exploit. For a simple example, an exploit that was a result of a flaw in the file specification could result in it being cross platform. It's going to be rarer to find something of that scope, maybe even to the point of you being effectively right.

Also dodgy files can contain multiple exploits, potentially for different platforms. Problem here from the malicious actor's point of view is that each vector for attack is also a vector for detection, so rather than a cesspool of exploits it makes more sense to use single new and mostly unknown exploit that targets software used by the greatest number of victims.

Re: Is Firefox lying to users about viruses in downloads?

#55

Post by Sidious » Wed, Jul 04, 2018, 4:39 PM UTC

sandov wrote: post #42

yodon wrote: post #21

If only the voting public understood about statistics, false positives, and false negatives. Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results. The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the…

And why the hell should the browser act as an antivirus?. It's a browser, not an antivirus, it should assume the user knows what he's doing, not treat him like a toddler. It's just a huge annoyance with no considerable benefit.

How likely do you think it is that this has something to do with some of the organisations 'donating' to Mozilla? As anti-piracy lobbying for instance.

Re: Is Firefox lying to users about viruses in downloads?

#56

Post by _cereal » Wed, Jul 04, 2018, 4:42 PM UTC

mediocrejoker wrote: post #34

davidsong wrote: post #30

There are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them. The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 1…

I could be wrong but I think technically a PDF exploit only affects a single viewer program, like Acrobat on windows, right?

It depends on the exploit and on the reader. If, for example, the reader supports javascript then it can be attacked, apart from other weaknesses. Chrome on Linux executes javascript in PDF, while Firefox does not.

Here is an example file: https://we.tl/q90gXERGmx

Built with https://github.com/cornerpirate/JS2PDFInjector

Re: Is Firefox lying to users about viruses in downloads?

#57

Post by tomsmeding » Wed, Jul 04, 2018, 4:43 PM UTC

ozim wrote: post #46

xg15 wrote: post #27

Earlier quoted context omitted.

And if only developers understood UX. The "lie" the author was complaining about was that Firefox is miscommunicating what it did: It warned that a concrete file was containing malware when it actually found a suspicious domain. Depending on context, that might make a huge difference - e.g., if a user got such a warning for a file they uploaded themselves, they might get the wrong impression that their system is comp…

Understand security, if there is malware in one file on your server you burn down the server and set up new one. If your machine gets infected you format all because it is insecure by definition. You might even need to throw out physical machine... If you get one it downloads ten other and you don't know which one will pass your virus scanner. It is not fun and games anymore, silly nerds having fun are not doing it.…

What you say is true, but how is this relevant to the discussion at hand?

Re: Is Firefox lying to users about viruses in downloads?

#58

Post by owly » Wed, Jul 04, 2018, 4:45 PM UTC

Who cares? Flagging sites probably provides an overall benefit for people to be careful on sites where viruses have been detected. People pirating books will still download them ‘cause if they are on a know pirate books site they’ve already accepted some risk. People who don’t know what their doing will still get infected.

Re: Is Firefox lying to users about viruses in downloads?

#59

Post by yodon » Wed, Jul 04, 2018, 4:47 PM UTC

tomsmeding wrote: post #57

ozim wrote: post #46

Earlier quoted context omitted.

Understand security, if there is malware in one file on your server you burn down the server and set up new one. If your machine gets infected you format all because it is insecure by definition. You might even need to throw out physical machine... If you get one it downloads ten other and you don't know which one will pass your virus scanner. It is not fun and games anymore, silly nerds having fun are not doing it.…

What you say is true, but how is this relevant to the discussion at hand?

It speaks to the argument that “if this site is serving up infected files, all files it serves should be treated as potentially infected”

Re: Is Firefox lying to users about viruses in downloads?

#60

Post by klez » Wed, Jul 04, 2018, 4:49 PM UTC

owly wrote: post #58

Who cares? Flagging sites probably provides an overall benefit for people to be careful on sites where viruses have been detected. People pirating books will still download them ‘cause if they are on a know pirate books site they’ve already accepted some risk. People who don’t know what their doing will still get infected.

In part I agree, but then again, it can become a problem à-la windows security prompt, where people have learned to basically ignore it and give permission to mostly anything.

In other words, in my opinion, don't cry wolf unless there's an actual wolf, or at least something that could reasonably look like one.